473 matches found
CVE-2022-3342 Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserialization
The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRMCSVImporterLitehtmlapp' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon...
CVE-2022-3342
CVE-2022-3342 (Jetpack CRM – zero BS CRM) is a PHP PHAR deserialization vulnerability in the ZeroBSCRM_CSVImporterLitehtml_app function. In affected WordPress plugin versions up to 5.3.1, nonce checks mis-handle failure and perform a file_exists check on zbscrmcsvimpf; supplying a phar:// archive...
WordPress Plugin Jetpack CRM Code Issue Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
Jetpack CRM < 5.5.1 - CRM Admin+ XSS
Description The plugin does not sanitise and escape the tax rate field and custom field placeholders, which could allow CRM Admin users to perform Cross-Site Scripting attacks against site Admins...
Deserialization of untrusted data
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization...
CVE-2023-2996 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization...
CVE-2023-2996
Jetpack WordPress plugin (versions prior to 12.1.1) is affected by a vulnerability where uploaded files are not validated. This allows users with author roles or higher to manipulate existing files, delete arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization. ...
CVE-2023-2996 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization...
CVE-2023-2996 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API
The Jetpack WordPress plugin before 12.1.1 does not validate uploaded files, allowing users with author roles or above to manipulate existing files on the site, deleting arbitrary files, and in rare cases achieve Remote Code Execution via phar deserialization...
PT-2023-22496 · WordPress · Jetpack
Name of the Vulnerable Software and Affected Versions: Jetpack WordPress plugin versions prior to 12.1.1 Description: The issue allows users with author roles or above to manipulate existing files on the site, including deleting arbitrary files. In rare cases, it can also lead to Remote Code...
WordPress plugin Jetpack 输入验证错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error vulnerabilit...
Automattic: Authentication bypass on JetPack SSO manager - Allows to access the administration panel of wordpress without user interaction
A vulnerability was found in the JetPack SSO manager plugin that allowed authentication bypass on WordPress sites using the plugin. By exploiting the plugin's account invitation and email verification features, an attacker could gain administrative access to WordPress sites with a user account...
CVE-2023-27429
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...
CVE-2023-27429
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...
CVE-2023-27429 WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...
CVE-2023-27429 WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Automattic - Jetpack CRM team Jetpack CRM plugin = 5.4.4 versions...
CVE-2023-27429
CVE-2023-27429 affects the WordPress Jetpack CRM plugin, versions
PT-2023-21117 · WordPress · Jetpack Crm
Name of the Vulnerable Software and Affected Versions: Jetpack CRM plugin versions prior to 5.4.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 5.4.4, update...
WordPress plugin Jetpack CRM 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...